Articles
Long-form writing on tech, culture, and the edges of the internet.
Chrome's fourth zero-day of 2026 ships mid-cycle
Fourth Chrome zero-day of 2026 is a V8 type confusion. Inside the exploit chain, sandbox escape, and the patch gap attackers are weaponising right now.
Cognizant's bench is shrinking by design
Cognizant's automation push isn't a productivity story - it's the collapse of the services pyramid. What's actually changing, and why most firms will get the transition wrong.
Copy.fail has been root since 2017
Copy.fail turns an unprivileged Linux user into root via a copy_file_range credential cache flaw. Reachable since 2017. Telemetry gaps explained.
Encrypted files are writing back to disk
Active ransomware event analysis from an operator perspective: what failed, the underlying mechanism, and the conditions that must now hold.
OpenAI's security plan protects nothing yet
M. Hale on the OpenAI cybersecurity action plan: provider-stated intent is not a control, and the consumer still owns the boundary.
CVE-2026-3854 puts GitHub inside your trust boundary
CVE-2026-3854 enables RCE on GitHub.com and Enterprise Server. Why platform compromise becomes customer compromise across identity, secrets, and artefacts.
Managed Agents pricing is an architecture decision
Claude Managed Agents pricing isn't a cost center - it's an orchestration lever. Here's how to evaluate it against real total cost of ownership.
ShinyHunters exfiltrated Cisco source through Trivy
ShinyHunters exfiltrated Cisco source code through Trivy. The scanner inherited the runtime's identity. The runtime held everything.
Losing your domain isn't a technical incident.
A domain transfer executed without documentation reframes the registrar as a third-party control surface the board does not directly enforce.
You still own every decision you automated.
When automation decides in threat detection and response, the judgment moves but the accountability does not - and the organisation owns every outcome it cannot explain.
Your second factor is a phone call
SMS 2FA on PayPal is a routing decision, not a credential. The session cookie is the boundary, and attackers have already routed around the factor.
A license audit caught the breach
A six-week account takeover surfaced during a license audit. The detection vector defines the control failure.